Recently, we interviewed Annie Searle, exclusively for The Connector.
PR4P: How did you get into risk management?
Annie Searle: I’ve been doing risk management since I spent summers as a lifeguard in Buffalo Center, Iowa. I worked on the night shift in a university psychopathic hospital in graduate school. My career has included stints in public television, the visual arts, technology and banking. I co-founded a computer hardware company in the early 1980s, and there were elements of risk management I mastered running the company, but also in solving problems and creating solutions for customers over 15 years. At Washington Mutual Bank, working with great teams, I took on progressively more responsibility, ultimately reporting to both the Chief Information Officer (CIO) and the Chief Risk Officer (CRO), gaining a reputation as a fixer of complex but troubled programs that regulators paid a lot of attention to – research, planning and architecture, business continuity, disaster recovery, the crisis management, technology change management, regulatory and audit assurance and some elements of the bank’s information security program. The bank loaned me for several national projects that integrated perspectives from the public and private sector as well as academia. In 2009, I started my own risk advisory firm, Annie Searle & Associates (ASA). The firm has a consulting practice, but also publishes regularly through the ASA Institute for Risk and Innovation. Teaching about risk has broadened my research as I find both historic and current events to illustrate the true costs of risk failures.
PR4P: What are the three most common types of risk in business?
Annie Searle: Annie Searle & Associates (ASA) focuses on six specific sectors that are part of the critical infrastructure of this country -- banking and finance, energy, communications, information technology, public health and emergency services. Most people don’t realize that over 80% of the organizations in these sectors are on the private sector side rather than on the government side. For these businesses, these days, the greatest threat comes from loss of their proprietary data, whether through human error or from external cyber-attack. The next greatest risk comes from the third parties that such companies contract with – ranging from vendors who provide onsite services, to those who provide software or other vital services. A third very large risk I have recently written on is what we call conduct risk, which is unethical or illegal behavior by certain employees. A good example of that would be recent misconduct at Wells Fargo, where the customer ends up being at the short end of the stick.
PR4P: What are the three most common types of risk in government?
Annie Searle: Until recently, I would have said that the same three types of risk I discussed for business also apply for government, though not necessarily in that order. That’s about to change with the new administration. The greatest risk is that those unfamiliar with government policy, process and regulation will drive out all the career professionals who currently make it run. Who and how will our government continue to operate with novices in charge?
PR4P: What advice would you give to small business owners who want to mitigate risk?
Annie Searle: First, document your expectations clearly for your employees through an employee guide or code of conduct. Carefully hire people for the jobs you advertise to avoid surprises and liability issues later. Next, ensure that you are operating with state of the art technology, and that someone is responsible for ensuring that all security or operating system updates are protecting your systems. There’s a much longer list of action items in Advice From A Risk Detective for owners of all businesses that ranges from how to avoid violence or harassment in the workplace to training for disaster recovery.
PR4P: What do you think are the three greatest threats in the world today?
Annie Searle: Because of the volatility of the situation, I would have to say the largest threat is the incoming administration. Ad hoc tweeting from a thin skin is certainly not the mark of any kind of leader, much less the incoming president. The next would be social media platforms with their ability to amplify false stories and fake news, with the access provided to groups like ISIS to recruit new converts, or for school age children to bully one another unmercifully. The third is a function of the first two, the possibility of all out nuclear buildups, over-the-top confrontations that escalate past diplomatic solutions, the targeting and profiling of diverse groups, the failure of the rule of law to protect all its citizens.
PR4P: You’ve had a long career, what do you consider your greatest accomplishments?
Annie Searle: My career is by no means over, so I don’t think that way. I’ve always wanted to be right in the center of things, to change the world, to make an impact. I feel like I have a real home on the faculty of the UW Information School, where I now teach full time, and where one of its maxims is “Information changes lives.” I designed two risk management courses and started teaching them in 2012. Now I also teach a course in ethics, policy and law in information management; another on the foundations of information management; and still another on consulting practices. I’m honored to be part of a major research university that has such a large commitment to inclusion, equity and social good. ASA is set up to accommodate the regular publication of a newsletter for risk professionals from around the world, with new research notes forthcoming every month that are then gathered in volumes of 25-30 research notes at a time, in a series called Reflections on Risk. To date, we’ve published three volumes.
Writing and public speaking have long been important parts of my work, whether in my consulting practice, my work at the university, or earlier in my career. They are both important levers to get policies and regulations rethought and/or improved, to change existing notions of what is possible or how things must be.
PR4P: You’ve written several books, tell us about them.
Annie Searle: My first book was Advice From A Risk Detective, published in 2011, with a second edition in 2013. It’s written for the general public, not for a professional or academic audience. It looks at how to handle personal risk at home, at school, at work, online and on the road.
There are three volumes published by the ASA Institute for Risk and Innovation in the Reflections on Risk series. The books are designed for risk professionals.
I recently finished a long chapter looking at conduct risk for the British publisher Risk Books. The book is titled Conduct Risk: A Practitioner’s Guide; and I am the author of Chapter 2, “How Does Conduct Risk Manifest and What Are Its Root Causes?” as well as a contributor to closing comments in Chapter 9 on the future of conduct risk.
I have been working for a couple of years on a book that would probably be called Executives and Risk: What Your Teams Don’t Tell You. I think the time has come on it to fish or cut bait. Do I want to spend the time to interview 5-8 chief executives in order to validate the preliminary conclusions I’ve come to? Is there time to continue to work on that book, given the challenges to our democratic way of life that we are about to experience over the next four years?
PR4P: What advice would you give to a young person who is aspiring to have a career in risk management?
Annie Searle: You must know how to read, to write and to make presentations that are clear and make it easy for your client to accept your recommendation. There’s a great deal of reading to get a real understanding of how the risk profession fits into enterprise wide strategy and decision making. It’s necessary to learn the various tools that can be applied to manage risk and to work methodically. When I teach, I say that I am training the next generation of risk managers – so naturally I recommend a program like the one I teach in.
PR4P: What keeps you up at night?
Annie Searle: Not very much. I earned the title “Princess of Darkness” about 15 years ago because of the enthusiasm I show for worst case scenarios and things that go bump in the night. If I’m going to worry, I’ll do it when I’m wide awake, usually not in the middle of the night.
